::puts on the BOFH hat::

[jecook]

Direct from the work order log. names changed to prevent me from losing my job. I just got a raise, and it would suck to lose that and more...

She has been very naughty, and she is losing her Local Administrator privledges, which I usually confer because frankly, I'm the odd duck who trusts their users to not install crap on their machines. Obviously, this gets abused.. ::sigh::


---
While reclaiming power adapter that was loaned out, I discovered the [luser] had non-company approved software installed on her computer, including Incredimail. This is not only NON-supported software, but I have removed it in the past from her machine and requested to her that she not use it, as there is not easy export method for it. Noticed unusual software on machine, which prompted me to kick it off the network. I then removed the system from her desk and brought it to my office for decomtamination, and forced re-building of a non-local Administrator profile.

Spyware found on system:

Powerscan (http://vil.nai.com/vil/content/v_124770.htm) (It ran on Startup when I logged in local Administrator to remove the rest of the Non approved software from the machine, and it was claiming to remove porn from the machine. I immediately powereed the system down and re-started from BartPE)
ISTBar (http://www.doxdesk.com/parasite/ISTbar.html , probably bundled with above, as the above uses this program to search your computer...)
Internet Optimizer (http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076206)
NAVexcel (http://www.doxdesk.com/parasite/NavExcel.html)
YourSiteBar (http://securityresponse.symantec.com/avcenter/venc/data/adware.yoursitebar.html)
SideFind (http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453088285)

Along with many, many Tracking Cookies.

Running Mcafee scan. Will transfer profile and re-create user as Power User only in a new profile after scan is finished.
--

Also note: this luser is one of our HR people, so you _know_ there's sensitive information on the damn machine....

Comments

[akage.livejournal.com]

Even better: the client I work for is a nationally recognized banking institution. And corporate policy pretty much dictates that every user have Administrator rights to their own PCs, otherwise a number of in-house designed apps won't work at all. Those apps also use a lot of ActiveX and pop-up windows, so browser security has to be set low, and pop-up blockers disabled.

Care to guess how much spyware we find on a daily basis?? Had one the other day with no less than 11 different keyloggers installed.

So it brings me to fits of laughter when there's a big story about identity theft, and all these CEOs and CIOs are wringing their hands and saying "we're doing all we can to protect your information..."

[megpie71.livejournal.com]

I'm just surprised you're letting her keep Power User status. I'd be busting that one down to "lowest of the low, needs supervision to boot" access. Let's face it, not only has she installed non-corporate software on her PC, but she has also *reinstalled* non-corporate software which you have previously asked her not to install. Priveleges blown, no forgiveness.

[jjjiii]

It's HR's **job** to view porn at work, in order to ensure that they do not hire former porn actors.

[jecook]

BWHAHAHAHAHA!!!!!!


Riiiiight....

[jecook]

Sounds like the same institution that manages our purchasing card program. We have to use IE and this totoally bogus and asinine Java applet in order to perform the reconcillation on our corporate purchasing cards. My boss has so far managed to break it every month in a new and interesting manner. We've had these cards since July of 04. It's interesting that he's managed to break each month. that's either really bad of him, or really bad of that software.. :)

[eightofspades.livejournal.com]

Power User is basically administrator...

Set her at user.

Folks at my office who do things like that get volunteered to be in pilot groups (;

[harry-whodunnit.livejournal.com]

That line deserves a metaquote. Mind if I immortalise you?

[jjjiii]

Yeah, go for it.

[jecook]

Sort of.

It won't let her do certain things like change network settings, or install software, which is why we made the change.

[harry-whodunnit.livejournal.com]

Here we go (http://www.livejournal.com/community/metaquotes/4435236.html).

[akage.livejournal.com]

Digging the icon, BTW. Nice retouch of the old Great Patriotic War posters...

[eightofspades.livejournal.com]

Wasn't planning on replying to this, but just had a thought while going through my email.

She's a malware-magnet - you've established this. Even without software install privs, a power user is still able to write to the HKLM and HKCR hives - meaning that all the web-borne malware she's clicking on will be able to install. It doesn't ask nicely or use the Windows Installer service that she is restricted from.

(Yes, I'm aware that technically, HKCR is a sub-hive of HKLM now, but most aren't.)